UAC-0056
Attribution profile
- Type
- Nation State
- Location
- Russia
- Known incidents
- 19 incidents
- Sources
- 7 sources
- First seen
- 2014-08-09
- Last seen
- 2023-02-23
- Updated
- 2026-10-07 02:42
- Aliases
- 4 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
The threat actor known as SaintBear, UAC-0056, UNC2589 and TA471 is a Russian state‑linked group that has conducted espionage, disruption and influence operations against Ukrainian government bodies, media organizations, Georgian agencies and occasional targets in North America and Western Europe. Its activity includes compromising Ukrainian central and local government websites via a long‑lived web shell deployed in December 2021, which was used to install CredPump, HoaxPen and HoaxApe backdoors with the aid of GOST and Ngrok tunneling tools. The group frequently initiates attacks with spear‑phishing emails containing macro‑embedded Excel documents that drop a Go‑language Elephant Downloader, which establishes persistence and delivers the GrimPlant (Elephant Implant) gRPC‑based backdoor and the GraphSteel (Elephant Client) credential stealer, often signed with stolen Microsoft certificates and employing encoded strings. It has also employed wiper malware such as CaddyWiper and WhisperGate, and leveraged the NotPetya ransomware/wiper through a compromised MeDoc software update that used EternalBlue and Mimikatz exploits. Additional tactics observed include phishing that delivers the IcedID banking trojan, exploitation of a Zimbra CVE‑2018‑6882 vulnerability via malicious JPG attachments to create email forwarding rules, and the use of fake social‑media accounts and Telegram channels to spread disinformation. Attribution to Russian state interests, including links to Russian military intelligence and the Sandworm group, is repeatedly cited in public reporting. Representative campaigns are the February 2023 web‑shell intrusion of Ukrainian government sites, the March 2022 Excel‑macro spear‑phishing against a Ukrainian TV channel, and the June 2017 NotPetya attack that originated from a compromised Ukrainian tax‑software update.
Incidents
Attributed incidents are available to members.
19 incidentsSources
Sources available to members: 7 sources.